www.indonezia.net Hacking Windows Registry
Upcoming SlideShare
Loading in...5
×
 

www.indonezia.net Hacking Windows Registry

on

  • 813 views

 

Statistics

Views

Total Views
813
Views on SlideShare
813
Embed Views
0

Actions

Likes
0
Downloads
12
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

www.indonezia.net Hacking Windows Registry www.indonezia.net Hacking Windows Registry Document Transcript

  • HACKING THE REGISTRY Click & Retrieve Source CODE! Hacking the Windows Registry BY KEITH PLEAS ately: some of them are particular to the USER also maps to a subkey). Keys beneath It’s a jungle out new Windows shell (first delivered on the root are referenced by building a string Windows 95 but currently in beta on Win- key by concatenating each node together, there, but with some dows NT), some work only with NT (also separated by backslashes. known as “Microsoft’s real operating sys- Each key also contains data stored in guidance, an intrepid tem”), and some will work for everybody. values: a key may have no values, a de- So, grab your tools (primarily a copy of fault value, or any number of named val- developer can unlock RegEdit) and prepare for an exciting round ues in addition to the default. The data in of hacking the registry. the values may be in a variety of forms, the secrets of the The registration database, commonly though text and binary data types are by called the registry, contains a substantial far the most common. While key names Win32 Registry. amount of data about the computer and and value names are never localized, text users. It includes computer data such as data often is. Using the Windows hardware, the OS, and installed applica- 95 RegEdit utility shows you a tions, and user much compacted view of the regis- I f USER, Kernel, and GDI are the heart, brain, and eyes of Windows, the reg- try including the root keys, several istry would be the memory—both subkeys, a default (text) value, and a long and short term. OK, maybe this meta- named (binary) value (see Figure 2). phor is a bit weak, but the point should be Note that Windows NT has a similar but obvious: the registry is a critical compo- slightly different structure: it omits HKEY_ nent of a well-functioning system and CURRENT_CONFIG and substitutes a some- you’re not going to get very far without it. what analogous HKEY_PERFORMANCE_ The registry is lightly documented and DATA for HKEY_DYN_ DATA. not well understood. Programming it can be similar to the old neurological tech- SPELUNKING THE REGISTRY nique of zapping part of the cerebral A variety of common components cortex with an electrode and see- can be found in the registry, ing what happens: the patient may information such as their desk- especially if they have anything remember a baseball game or expe- top settings and customization prefer- to do with OLE. Here are some rience a war-related flashback. In Windows, ences. The registry stores data in a hierar- examples so you’ll know what you’re look- you may enable a cool new feature or ren- chically structured tree. Each node in the ing at when you go spelunking with RegEdit. der your system unbootable. But it’s the tree is called a key. Each key can contain Creatable OLE classes, provided by thrill of the hunt that makes it so exciting. additional keys called subkeys (see Figure OLE servers, must be in the registry. Each After a brief introduction to get our ter- 1). Keys are composed of printable char- class is registered separately in the minology straight, I’ll skip the fundamen- acters and cannot include backslashes HKEY_CLASSES_ROOTCLSID key under tals of the registry—MSDN would be an () or wildcard characters (* or ?). Sev- its CLSID and must, at minimum, have ideal place to find this information—and eral predefined keys, represented with enough information for the OLE system to leap into advanced aspects. uppercase words separated by under- locate and start the server. For example, Along the way I’ll note a variety of scores, can be accessed using numeric Access registers the Application object thing you can take advantage of immedi- constants. These keys are always “open,” with the key name on the left and the so it’s not necessary to use the RegOpen... default value on the right: Keith Pleas is an independent developer, functions on them. It’s important to note author, and trainer. He is the author of the that the root key for machine information {B54DCF20-5F9C-101B- Microsoft Access Database forthcoming book, Visual Basic Tips & HKEY_LOCAL_MACHINE (HKEY_CLASSES_ AF4E 00AA003F0F07} Tricks, from Addison-Wesley. He can be ROOT and HKEY_CURRENT_CONFIG map InprocHandler32 ole32.dll reached on Compu-Serve at 71333,3014 (from to subkeys) and the root key for user infor- LocalServer32 C:MSOFFICEACCESSMSACCESS.EXE the Internet: 71333.3014@compu-serve.com). mation is HKEY_USERS (HKEY_CURRENT_ ProgID Access.Application.7 22 MARCH 1996 Visual Basic Programmer’s Journal ©1991–1996 Fawcette Technical Publications http://www.windx.com
  • HACKING THE REGISTRY {27395F85-0C0C-101B-A3C9-08002B2F49FB} 1.0 Microsoft PictureClip Control 0 win32 C:WINDOWSSYSTEMPICCLP32.OCX FLAGS 2 HELPDIR C:VB4 Note that the type library itself can be stored as a separate file on disk (typically with a TLB or OLB extension) or attached as a resource to a DLL or EXE. Because OLE controls are in fact DLLs, their type libraries are most often stored with the control itself. The HELPDIR key is notable because it points to the fully qualified location for the accompanying WinHelp file containing additional programming documentation about the control. This location can obviously vary by installation and is typically deter- mined when the control is first installed: if the WinHelp file is moved the link can obviously be broken. Licenses, such as those used by OLE controls, are also commonly stored in the registry. They can be found under the HKEY_CLASSES_ROOTLicenses key, where you’ll also find the warning that “Copying the keys may be a violation of established copyrights.” No kidding. Anyway, each license is stored under its own GUID. This example from my registry database has both design and run keys (with the key values changed, naturally): {B54DCF20-5F9C-101B-AF4E-00AA003F0F07} Retail abcdefghijklmnopqrstuvwxyzabcdefghij FIGURE 1 Related Entries in theroot keys map to major(Win95) Registry. Expanded Runtime abcdefghijklmnopqrstuvwxyzabcdefghij registry keys depict how subkeys for current user, classes, and current configuration. VB4 itself uses this technique: when it’s installed it merges the contents of one of the three REG files (for Standard, Professional, and Enterprise editions) into the registry. OLE controls, being specialized in-process OLE servers, must Finally, the registry contains information about remoted OLE be in the registry. If an OLE control is referenced by an application servers in both their local and remote configurations. Like the other but is not in the registry, it can autoregister itself if the system can OLE object described here, this VB4-created OLE Automation locate it by searching along the normal DLL search path. server registers a Clerk class under its own GUID in the OLE controls are registered as classes and can also be found HKEY_CLASSES_ROOTCLSID key. Of course, VB4 handles all the in the HKEY_CLASSES_ROOTCLSID key by referencing their registration automatically and it’s typically not necessary to modify CLSID. For example, the PicClip control that ships with VB4 has these entries directly. the following registry entries: Running the Remote Automation Connection Manager (RacMgr32) utility included with VB4 Enterprise Edition adds additional keys for {27395F85-0C0C-101B-A3C9-08002B2F49FB} PicClip Control a remote machine name, RPC protocol, and RPC authentication Control level. When run locally, this particular class is registered as: InprocServer32 C:WINDOWSSYSTEMPICCLP32.OCX Insertable {8435CD47-D6BE-11CE-A842-00AA00688747} MiscStatus _AuthenticationLevel 2 ProgIDPicClip.PictureClip _NetworkAddress NT ToolboxBitmap32 C:WINDOWSSYSTEMPICCLP32.OCX, 1 _ProtocolSequence ncacn_ip_tcp TypeLib {27395F85-0C0C-101B-A3C9-08002B2F49FB} InprocHandler32 OLE32.DLL Version 1.0 LocalServer32 D:PROJMSJCAR RENTALRENTAL OBJECTS.EXE ProgID RentalObjects.Clerk The Control key is used when dialog boxes like the OLE Insert TypeLib {8435CD4E-D6EB-11CE-A842-00AA00688747} Object dialog or VB4’s Custom Controls dialog is displayed with the Controls box checked. InprocServer32 contains the fully When the class is remote, RacMgr32 changes the registration qualified path to the control. entries to: ProgID contains the so-called “friendly” name, which can also be found in a separate key under HKEY_CLASSES_ROOT: this separate {8435CD47-D6BE-11CE-A842-00AA00688747} key contains a pointer back to the CLSID where all the information for _LocalServer32 D:PROJMSJCAR RENTALRENTAL OBJECTS.EXE the control is maintained. The Insertable key behaves similarly to the AuthenticationLevel 2 Control key, though it may be duplicated under the ProgID key for InprocHandler32 OLE32.DLL backward compatibility with OLE 1.0 servers. InprocServer32 C:WINDOWSSYSTEMautprx32.dll The type library for a control is indicated in the TypeLib key. NetworkAddress NT Type libraries are stored separately in the registry under their ProgID RentalObjects.Clerk own GUIDs in the HKEY_CLASSES_ROOTTypeLib key. The ProtocolSequence ncacn_ip_tcp entries for the PicClip control’s type library are: TypeLib {8435CD4E-D6EB-11CE-A842-00AA00688747} http://www.windx.com ©1991–1996 Fawcette Technical Publications Visual Basic Programmer’s Journal MARCH 1996 23
  • HACKING THE REGISTRY Text Value Keys Subkeys Binary Value Keys to the Windows Registry. The hierarchical structure of the registry consists of keys and subkeys. The associated values FIGURE 2 for each key can be named (text) or a non-string data type (binary). Notice how the LocalServer32 key gets renamed (actually, provided for backward compatibility only and shouldn’t be keys cannot be renamed, so it is destroyed and re-created) and used (the corresponding ...Ex functions, which support named an additional InprocServer32 key is created. This new key values and access to keys other than HKEY_CLASSES_ROOT, points to the remote automation proxy on the local machine, should be used instead). initiating a conversation with the AutMgr utility running on the Rather than torture you with a complete list of the APIs, I’ll remote machine. point you to a couple of useful samples that highlight their Of course, you’ll never want to touch these registration entries implementation such as the RegTool sample that ships on the directly. In addition to using RacMgr32, we can also call the RacReg VB4 disc. The RegTool sample is buried down in the Tools OLE Automation server in code to examine and change server Dataex32SourceRegtool subdirectory and has a reusable class settings. To do so add a reference to the RacReg32.DLL, create a with routines for creating, updating, and deleting keys. Unfortu- RacReg.RegClass object, and use the GetAutoServerSettings func- nately, while it can read both string and numeric (dword) data, tion and SetAutoServerSettings method. it can only write strings. Unfortunately, the documentation for these functions is a little A much better example can be found in the file REGVB4.ZIP in the obscure: it’s only found in the ReadMe file that ships with VB4. But Magazine Library of the VBPJ Forum on CompuServe. Written by it’s pretty obvious how the RacReg32 server reads/writes the Don Bradner, VBPJ Forum Section Leader of the “32-Bit Bucket,” registry settings shown in this function prototype: REGVB4 is a handy VB4 version of RegEdit that has well-commented source code for reading and writing both string and numeric values. object.SetAutoServerSettings (Remote, [ProgID], [CLSID], _ Several of the registry functions deserve a bit more com- [ServerName], [Protocol], [Authentication]) ment. While we do not yet have built-in support for a distributed registry (where part or all of your registry is stored on another A side benefit of using the RacReg.RegClass object is that machine), the RegConnectRegistry function can be used pro- Microsoft’s VB group promises that your code will be upwardly grammatically to connect to remote registries and get/set val- compatible with future versions of VB, which will support true ues from their registries. They can connect only through the Networked OLE: they’ll do the work of encapsulating the changes root keys (HKEY_LOCAL_MACHINE and HKEY_USERS), but be- so that you don’t have to change your code. cause of the subkey mappings to HKEY_CURRENT_ USER, HKEY_CLASSES_ROOT, and HKEY_CURRENT_CONFIG USING REGISTRY FUNCTIONS this isn’t a major limitation. The Win32 API provides a function group of 26 APIs, many of There are also a few differences between the Win95 and WinNT them with both “A” (ANSI) and “W” (Wide, or Unicode) ver- implementations of the registry functions. Of course, Win95 knows sions, for working with the registry. Five of the 26 APIs are nothing about security, so Get/SetKeySecurity aren’t implemented 24 MARCH 1996 Visual Basic Programmer’s Journal ©1991–1996 Fawcette Technical Publications http://www.windx.com
  • HACKING THE REGISTRY on that platform. Also, while Win95 does implement QueryInfoKey, it doesn’t track the last write time, so don’t be surprised when the FILETIME structure comes up empty. Another thing to watch out for, particularly if you develop under Win95, is that RegDeleteKey on that platform deletes key and descendants, whereas on NT it can only delete keys that have no subkeys. Because of its architecture, Win95 has very limited support for kernel synchronization objects, and thus RegNotifyChangeKeyValue is not supported at all. Win95 also doesn’t implement RegRestoreKey, which can be worked around tediously by writing code to re-create the keys or, much easier, by using a REGEDIT4 file. Interestingly, RegQueryMultipleValues is only implemented on Win95 (though its primary value appears to be as a coding shortcut). Finally, if you must store Unicode data in the Win95 registry you must store it as REG_BINARY, because Win95 is an ANSI system. It’s also worth pointing out that VB4 includes built-in func- tions for working with the registry, though they only work with information from a specific location in the registry: HKEY_CURRENT_USERSSoftwareVB and VBA Program _ Settings<program name> Adding the TXT File Type to the Explorer. This view of I’ve seen a number of people experience problems with the FIGURE 3 the New menu in the Win95 explorer is fairly typical, built-in VB functions.GetSetting and GetAllSettings are functions, except that by using the registry, I added the TXT file type to the menu. but SaveSetting and DeleteSetting are statements and thus don’t Selecting it launches Notepad, the file associated with TXT files. use parentheses. While SaveSetting and DeleteSetting were origi- nally specified as functions, later they became statements. REGEDIT4. REGEDIT4 was introduced to deal with named values. RegEdit can run from the command line, but in this configuration, IMPORT DATA INTO THE REGISTRY it will not be able to load REGEDIT4 files. If you’re working on NT, It’s common to use registration (REG) files for importing data you should use the RegIni utility from the NT Resource Kit. into the registry. REG files have two formats: REGEDIT and CONTINUED ON PAGE 30. http://www.windx.com ©1991–1996 Fawcette Technical Publications Visual Basic Programmer’s Journal MARCH 1996 25
  • HACKING THE REGISTRY Adding the Test VB Finder to the Find Menu in Explorer. The registry structure for dynamically added Find items illustrates FIGURE 4 how simple it is to add items to the menu. A modified Find Menu in the new shell’s Explorer show an entry added by MSN as well as two custom entries described here. It’s just as easy to add an entry for something like Yahoo for finding files on the Internet. CONTINUED FROM PAGE 26. • Invalid ProgID key. This shows the contents of a trivial REG file using the old format: • Missing OLE key. • Wrong value for OLE key. REGEDIT • Missing file. HKEY_CLASSES_ROOT.txt = txtfile • Empty subkey. • Conflicting local/remote keys. And, this shows this new format (with a named value): • Improper InprocServer registration. • Server isn’t AUTPRX16.DLL/AUTPRX32.DLL. REGEDIT4 • Differing server paths. [HKEY_CLASSES_ROOT.txt] • Missing InprocServer key. @="txtfile" "Content Type"="text/plain" RegClean also gives you the option of creating a pending change file or just letting it rip and make the changes for you (guess If you distribute a REG file with your application, be aware which one I chose). that Setup Toolkit has somewhat limited support for this. You can add a REG file with the Add Files button and the Setup EXTENDING THE NEW SHELL Toolkit will register those keys on the user’s machine. However, If you’ve selected New from the File menu within the Windows you are limited to embedding relative paths and there’s no 95 Explorer, after what seems like an inordinate delay you’ve automated support for uninstalling the REG file entries. seen a cascading menu (see Figure 3). If you’ve been following along on your machine, your registry The shell is searching through the registry looking for valid might be getting a little wonky. It’s not uncommon for your file extensions (those beginning with “.”) that have a subkey of registry to get whacked: hacking around manually just tends to ShellNew. Each time it finds one, it reads the value in the accelerate this process. Eventually, you’re going to want to use extension’s key to determine the ProgID, looks up the ProgID, the little-known RegClean utility (16- and 32-bit) that ships with and adds the value of that key to the menu. VB4 and is located in the ToolsPSS subdirectory. It can For example, to add the TXT item to the menu shown in correct a number of these problems in your registry: Figure 3, I added the ShellNew key to the CLSID key for “.txt” files: • Mismatched GUID in TypeLib. • Missing TypeLib GUID. HKEY_CLASSES_ROOT.txt = txtfile • Missing CLSID for ProgID. ShellNew • Useless NumMethods or BaseInterface keys. CONTINUED ON PAGE 34. 26 MARCH 1996 Visual Basic Programmer’s Journal ©1991–1996 Fawcette Technical Publications http://www.windx.com
  • HACKING THE REGISTRY HKEY_CLASSS_ROOT. = "txtfile" or you can enter your own class as in this example: Dim CRLF As String Dim QT As String Dim sFile As String HKEY_CLASSS_ROOT. = "none" For x = 1 To Len(txtFile) 'Double HKEY_CLASSS_ROOTnoneDefaultIcon = "notepad,1" If Mid$(txtFile, x, 1) = "" Then sFile = _ HKEY_CLASSS_ROOTnoneshellopencommand = “notepad.exe "%1."" sFile & "" sFile = sFile & Mid$(txtFile, x, 1) Next x If you just want to add a single menu command to the context CRLF = Chr$(13) & Chr$(10) menu of a specific file type, you can use a similar technique QT = Chr$(34) method: these two entries will add an Edit menu item to VB txtScript = "" txtScript = "REGEDIT4" project (VBP) files and load them into Notepad: txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE_ HKEY_CLASSS_ROOTVisualBasic.ProjectshellEdit = "" SOFTWAREMicrosoftWindowsCurrentVersionexplorer_ HKEY_CLASSS_ROOTVisualBasic.ProjectshellEditcommand = "notepad.exe "%1."" FindExtensionsStatic" & txtShort & "]" txtScript = txtScript & CRLF & "@=" & QT & _ txtGUID & QT EXTENDING THE FIND MENU txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE_ The new shell can be extended in a number of ways using, not SOFTWAREMicrosoftWindowsCurrentVersion_ surprisingly, a mechanism called shell extensions. Shell exten- explorerFindExtensionsStatic" & txtShort & _ "0]" sions are implemented as specialized DLLs that create OLE COM txtScript = txtScript & CRLF & "@=" & QT & _ objects and support specific OLE interfaces. One example is the txtDescription & QT built-in “Files or Folders...” and “Computer...” menu items found txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE_ on the Find submenu. While it’s possible to add to this menu, SOFTWAREMicrosoftWindowsCurrentVersion_ explorerFindExtensionsStatic" & txtShort & _ just as MSN does with the “On The Microsoft Network...” item, "0DefaultIcon]" shell extensions cannot currently be written in VB. txtScript = txtScript & CRLF & "@=" & QT & sFile & _ Fortunately, Jeff Richter has written a custom FindExt.DLL ",0" & QT that encapsulates the necessary functionality and allows at- txtScript = txtScript & CRLF txtScript = txtScript & CRLF & _ tachment of any program to the Find submenu (see Figure 4). "[HKEY_CLASSES_ROOTCLSID" _ You generate custom CLSIDs that point to this DLL: when one is & txtGUID & "FindCmd]" invoked, the DLL looks up the associated command line and txtScript = txtScript & CRLF & "@=" & QT & sFile & QT executes it. This compiled DLL is included with the sample code txtScript = txtScript & CRLF & _ "[HKEY_CLASSES_ROOTCLSID" _ for this article available on VBPJ’s Development Exchange on & txtGUID & "InprocServer32]" CompuServe (GO WINDX), The Microsoft Network (GO WINDX) txtScript = txtScript & CRLF & "@=" & QT & _ and the World Wide Web (http://www.windx.com) and can be "FindExt.dll" & QT freely distributed. Richter will be writing about and publishing txtScript = txtScript & CRLF & QT & _ "ThreadingModel" & QT _ the source code later this year. & "=" & QT & "Apartment" & QT Extensions to the Find submenu are stored in the registry, txtScript = txtScript & CRLF buried in the HKEY_LOCAL_MACHINESOFTWARE MicrosoftWindowsCurrentVersionexplorer REGEDIT4 Script Generation. This script is pretty FindExtensions subkey. Extensions stored at that level are loaded LISTING 1 standard string manipulation code, with one exception. automatically when the Explorer is first loaded (normally the Note the required doubled backslashes and trailing blank line. shell boots when Windows 95 is first loaded). The Static subkey beneath that contains extensions that are loaded dynamically: they are invoked when the user selects the item on the Find submenu. This is where you should put your custom find utilities. which, when accessed by the shell, was translated into the: To do so you need to create three additional nested subkeys: the extension that points to the CLSID of the InProc server, the HKEY_CLASSES_ROOTtxtfile = TXT menu text, and the menu icon. The first item to add is the extension that points to the CLSID of the InProc OLE server. Of course, the point of this isn’t that you can launch Notepad The name of this key (InetFind, MSNFind, and VBFind in the (though that is somewhat useful), but that you add your figure) is unimportant: Windows never displays it and the program to the New item from your users File menu with very submenu items are actually drawn from the registry in the order little effort. they were added, not alphabetically. The value of this key is the The shell can be extended in many other ways. For example, text version of a CLSID that points to FindExt.DLL, in this case. you can add a destination application to the Send To menu for all Next, add the menu text itself (including an accelerator key if Explorer items by placing a shortcut to the destination applica- desired). The name of this key must be “0.” tion in the WindowsSendTo folder. I suggest you create a Finally, add the icon to be displayed in the menu, which has shortcut in the WindowsSendTo directory for RegSvr32.EXE. a value that includes the file name of the executable and the Heck, you don’t even have to run RegEdit to do this one. index of the icon (typically zero) to be used. The name of this key You may have clicked on files in the shell that don’t have must be “DefaultIcon.” any extension: the resulting dialog is annoying but at least you To see the new menu item, it’s necessary to restart the can associate the file with a particular application. Unfortu- Explorer. You can either restart Windows 95, which is slow and nately, that association doesn’t “stick” and you have to do this inconvenient, particularly if you have multiple applications every time. Files without an extension are of class “.” and you open, or you can shut down and restart the shell. To shut down must manually add this type to the registry. You can either add the shell, choose “Shutdown” from the Start menu and, when a single key that points to whatever (for instance) a “txtfile” you see the “Shut Down Windows” dialog box, hold down the might be: CONTINUED ON PAGE 38. http://www.windx.com ©1991–1996 Fawcette Technical Publications Visual Basic Programmer’s Journal MARCH 1996 27
  • HACKING THE REGISTRY The first step in using this utility is to generate a new CLSID, VB4 which is equivalent to a GUID (for “Globally Unique ID” in Microsoft terminology) or UUID (for “Universally Unique ID,” in DCE/RPC Declare Function RegNotifyChangeKeyValue Lib _ "advapi32.dll" _ terminology). (ByVal hKey As Long, ByVal bWatchSubtree As Long, _ VB creates GUIDs for us automatically when we create OLE ByVal dwNotifyFilter As Long, ByVal hEvent As Long, _ Servers, and the GUIDGen utility included in the Win32 SDK ByVal fAsynchronus As Long) As Long can be used to generate them manually. Anyway, I want to Declare Function WaitForSingleObject Lib "kernel32" _ (ByVal hHandle As Long, ByVal dwMilliseconds As _ create a CLSID programmatically so I need to create a GUID Long) As Long structure and fill it in by calling the OLE function CoCreateGuid, Declare Function CreateEvent Lib "kernel32" Alias _ which in turn calls the RPC function UuidCreate. "CreateEventA" (lpEventAttributes As Long, ByVal _ The Win32 documentation states that UuidCreate is not bManualReset As Long, ByVal bInitialState As Long, _ ByVal lpName As String) As Long implemented on Windows 95, but that isn’t true: it can be Declare Function CloseHandle Lib "kernel32" (ByVal _ found in RPCRT4.DLL. hObject As Long) As Long The Win32 header files give this structure for a GUID: Public Const HKEY_CLASSES_ROOT = &H80000000 Public Const REG_NOTIFY_CHANGE_ATTRIBUTES = &H2 typedef struct _GUID { // size is 16 Public Const REG_NOTIFY_CHANGE_LAST_SET = &H4 Public Const REG_NOTIFY_CHANGE_NAME = &H1 DWORD Data1; Public Const REG_NOTIFY_CHANGE_SECURITY = &H8 WORD Data2; WORD Data3; Private Sub cmdRegistry_Click() BYTE Data4[8]; Dim lChange As Long mhEvent = CreateEvent(0&, False, False, vbNullString) } GUID; lChange = RegNotifyChangeKeyValue_ (HKEY_CLASSES_ROOT, True, _ which I translated into this VB code: REG_NOTIFY_CHANGE_NAME, mhEvent, True) tmrRegistry.Enabled = True Me.Caption = "Waiting for registry change..." Type tGUID P1 As Long End Sub P2 As Integer P3 As Integer Private Sub tmrRegistry_Timer() Static lSignal As Long P4 As Byte Static lResult As Long P5 As Byte P6 As Byte lSignal = WaitForSingleObject(mhEvent, 0&) If lSignal = 0 Then P7 As Byte Me.Caption = "Registry Changed" P8 As Byte tmeRegistry.Enabled = False P9 As Byte lResult = CloseHandle(mhEvent) P10 As Byte End If P11 As Byte End Sub End Type Declarations and Code for Handling Registry The CoCreateGuid declaration was pretty obvious: LISTING 2 Change Notification.The cmdRegistry_Click subroutine creates the event object, passes its handle to the system signalling Declare Function CoCreateGuid Lib _ when the registry changes, and starts the polling timer. Details about "OLE32.DLL" (guid As tGUID) As Long Registry Change Notification messages are shown in Table 1. Calling it is dead simple: Ctrl-Alt-Shift key combination and click on the “No” button. This Dim tmp As tGUID leaves you in something like the old shell, where pressing Ctrl- lRet = CoCreateGuid(tmp) Escape brings up the Task Manager, from which you can select “Run” from the File menu and restart Explorer. Unfortunately, the GUID you end up with is binary. You need Although the menu item is visible at this point, it won’t a string in this format: “{xxxxxxxx-xxxx-xxxx-xxxx- actually do anything. To make it work, you must add the CLSID xxxxxxxxxxxx}”. The Win32 API does provide a UuidToString to the HKEY_CLASSES_ROOTCLSID key and create a couple of function located in RPCRT4.DLL and the Win32 SDK header files additional subkeys: the CLSID of the OLE InProc server refer- provides this prototype: enced by the Find extension, the command line to be executed by FindExt.DLL, which must be stored under the FindCmd key, UuidToStringA ( and finally the InprocServer32 key with two values. The first, IN UUID __RPC_FAR * Uuid, which is the default, contains the path (if appropriate) and file OUT unsigned char __RPC_FAR * __RPC_FAR _ name of the FindExt.DLL, which will typically be located in the * StringUuid WindowsSystem subdirectory. ); The second key, “ThreadingModel,” should be set to “Apart- ment” because the FindExt.DLL uses that mechanism and is, in fact, But, it turns out that this function isn’t callable from VB. thread safe. The threading model applies only to OLE Servers that However, another function, StringFromGUID2, gets us on the are loading in process. The steps I’ve outlined are a bit tedious, yet right track using this declaration: they must be carried out exactly for this to work properly. To ease the procedure, I wrote a small Finder Installation utility that Declare Function StringFromGUID2 Lib _ automates the whole process (available for download from the "OLE32.DLL" (guid As tGUID, lpszString As _ online services described elsewhere in this article). Byte, lMax As Long) As Long 28 MARCH 1996 Visual Basic Programmer’s Journal ©1991–1996 Fawcette Technical Publications http://www.windx.com
  • HACKING THE REGISTRY platforms, support for registry change notifications (through MESSAGE DESCRIPTION RegNotifyChangeKeyValue) is supported only on NT. While a full discussion of kernel synchronization objects—such REG_NOTIFY_CHANGE_NAME Changes to key names that occur in the specified as mailslots, processes, threads, mutexes, events, semaphores, file key or in the specified key and its subkeys cause handles, file mappings, named pipes—will have to wait until an- a change notification. This includes key creations other time, I’ll cover only registry synchronization for now. and deletions. Kernel event objects can exist in either a signaled or not- REG_NOTIFY_CHANGE_ATTRIBUTES Attribute changes that occur in a key or in a key signaled state. Basically, we create an event object, tell the and its subkeys cause a change notification. system to signal that object when the registry changes, and wait REG_NOTIFY_CHANGE_LAST_SET Changes to the last write time that occur in a key for the object to get signaled. Normally this is done synchro- or in a key and its subkeys cause a change nously by suspending the calling thread until the signal occurs. notification. Unfortunately, because VB apps can currently use only a REG_NOTIFY_CHANGE_SECURITY Security-descriptor changes that occur in a key or in single thread, this would have the effect of hanging the entire a key and its subkeys cause a change notification. app until the change occurs. Freezing an application is consid- What’s Changed? Registry change notification messages, ered to be sub-optimal from an implementation standpoint TABLE 1 and their descriptions. Be aware that some messages that (users generally don’t like this), so I programmed around this exist on Windows NT aren’t supported by Windows 95. limitation using a Timer and periodically checking the state of the event. While polling is usually a sign of a bad application Calling this function and putting the result into the Text architecture, in this case there’s no other choice. control is a piece of cake: To illustrate this, I created a small testing application that’s easy to follow (see Listing 2). The code starts in the Dim bBuff(256) As Byte cmdRegistry_Click subroutine, which creates the event object, lRet2 = StringFromGUID2(tmp, bBuff(0), 256&) passes its handle to the system to get signaled when the registry txtGUID = bBuff changes, and starts the polling timer. The timer calls WaitForSingleObject (with a time of 0 milliseconds) and returns These three lines of code are doing a lot. The contents of the bBuff immediately. byte array are actually a Unicode string. If you examine it in detail, When the event gets signaled, the timer is disabled and the you’ll see that every element contains the ASCII value of a character event object is destroyed by closing its handle. This particular that you want in the string version. Assigning the contents of the example looks for changes to key names at the root level of buffer to a string (or, in this case, the text property of a Text control) HKEY_CLASSES_ROOT and includes subkeys: it’s probably the converts it correctly because VB4 strings are internally Unicode. most useful, although you may want to examine the other The second and third steps are to simply fill in the extension options from the Win32 SDK (see Table 1). key name (which is not used), menu text, and complete com- As a final reminder, since the RegNotifyChangeKeyValue mand line that we wish to execute. function is implemented only on Windows NT, this tester won’t The fourth step is to generate a complete REGEDIT4 script that do anything on Windows 95. contains all of the entries in the appropriate format. This is Here are some useful tips. First, any long file names stored in straightforward VB string manipulation code (see Listing 1) with the registry should be enclosed in quotes, like this: these caveats: any key value containing a backslash character must be doubled and the script must have a blank line at the end shellopencommand = “C:Program FilesMy AccessoriesWinWord.Exe” %1 for the previous line to be registered correctly. The last step is to copy this script into a REG file and execute it from the shell. Alternately, the short file name could be stored so it will work on Again, because you create your own CLSID, you can have any all systems. An example of this is the system-supplied Find utility that number of Find extensions on a system without worrying about supplies the “Files or Folders...” and “Computer...” menu items: colliding with one written and installed by someone else. Be- cause the FindExt.DLL is internally calling the new Win32 C:Progra~1TheMic~1findstub.dll ShellExecute function, you can even substitute the executable file name with something like this: While type and size of data you can store in the registry is relatively unlimited, in general you should not store frequently http://www.yahoo.com accessed data in the registry. Registry access is much slower than shared memory and even slower than file access. You should also You might associate this with the menu description “On The be aware that named values consume less space than keys &Internet... .” Choosing this automatically brings up the Internet consume. You might also consider packing data together into a Explorer, logs you on to the Internet, and take you to the Yahoo structure and storing the entire structure as a single binary value. finder. Other ideas for Find extensions might include a com- If your application is adding more than a couple of kilobytes pany-wide address book, a shortcut to MSDN, or virtually any- to the registry, consider storing a pointer to that data and thing else that makes sense to you. locating it elsewhere, either as a file or perhaps as a type library. Also, while it’s certainly possible, Microsoft strongly encour- DIFFERENCES BETWEEN NT AND 95 ages developers not to store binary, executable programs in the As developers are all too painfully aware, there are major registry. If you’re still interested in the registry and are looking differences between the Windows 95 and Windows NT plat- for a place to jump in where you’re likely to see familiar stuff, I’ll forms. Some of these differences will disappear over time: the leave you with these keys as “suggested reading:” NT Shell Update Release (SUR) will add the new shell, TAPI support, and so on, while some of the most glaring differences, HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDlls like Windows 95’s lack of security, will remain. One of the gray HKEY_LOCAL_MACHINESystemCurrentControlSetcontrolSessionManagerKnownDLLs areas is support for theWin32 Kernel synchronization objects: HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionIniFileMapping while support for the file change notifications is supported HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionAppPaths through the FindXXXChangeNotification family of APIs on both HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall http://www.windx.com ©1991–1996 Fawcette Technical Publications Visual Basic Programmer’s Journal MARCH 1996 29